Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

IPS Alerting to multiple locations

Will adding multiple alerting destinations have a dramatic CPU impact

over a single destination when under significant alerting load?

1 ACCEPTED SOLUTION

Accepted Solutions
Gold

Re: IPS Alerting to multiple locations

If your sensor is not overloaded today, it's doubtfull that adding an additional SDEE feed will push it over the edge. But if you're already showing a missed packet percentage in your logs, then adding another event feed won't do your sensor any favors.

- Bob

2 REPLIES
Gold

Re: IPS Alerting to multiple locations

If your sensor is not overloaded today, it's doubtfull that adding an additional SDEE feed will push it over the edge. But if you're already showing a missed packet percentage in your logs, then adding another event feed won't do your sensor any favors.

- Bob

Cisco Employee

Re: IPS Alerting to multiple locations

In addition to Bob's points, please be aware that Cisco's IPS sensors have a limit to five (5) open SDEE subscriptions; this equates to five (5) "alerting destinations". If you configure more than five (5) you may encounter subscription contention and inconsistent events being logged at each destination.

Scott

728
Views
0
Helpful
2
Replies
CreatePlease login to create content